@exagone313/dsh-podman 0.2.0-rc.2

package/dist/read-only-shell.test.js

@@ -0,0 +1,127 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { READ_ONLY_GATED_TOOLS, REMOUNT_TOOL_NAME, createReadOnlyShellGate, } from "./index.js";
+import { WORKSPACE_ID } from "./test-support.js";
+const EXEC = {
+    name: "bash",
+    arguments: {},
+    agent: { session: { header: { cwd: "/proj" } } },
+};
+// A resolver whose control plane reports one container with the given mounts,
+// recording every control call; the gate's approval is recorded by reason.
+function gateFixture(mounts, options = {}) {
+    const controlCalls = [];
+    const approvals = [];
+    const containerName = options.containerName ?? "default";
+    const resolver = {
+        registry: { resolveByPath: async () => ({ id: WORKSPACE_ID }) },
+        getConfig: () => ({ projectsRoot: "/projects" }),
+        async control(method, request) {
+            controlCalls.push([method, request]);
+            if (method === "listContainers") {
+                return mounts === undefined
+                    ? { containers: [] }
+                    : {
+                        containers: [
+                            {
+                                workspaceSlug: WORKSPACE_ID,
+                                containerName,
+                                mounts,
+                            },
+                        ],
+                    };
+            }
+            return {};
+        },
+    };
+    const gate = createReadOnlyShellGate({
+        resolver,
+        approve: async (_exec, reason) => {
+            approvals.push(reason);
+            return options.approve ?? true;
+        },
+    });
+    return { gate, controlCalls, approvals };
+}
+test("the gate ignores tools outside its set", async () => {
+    const { gate, controlCalls } = gateFixture([]);
+    assert.equal(await gate({ ...EXEC, name: "image_list" }, "en"), undefined);
+    assert.equal(await gate({ ...EXEC, name: "container_read" }, "en"), undefined);
+    assert.deepEqual(controlCalls, []);
+});
+test("the gate covers the shell, file, and daemon tools", () => {
+    assert.deepEqual([...READ_ONLY_GATED_TOOLS].sort(), [
+        "bash",
+        "container_bash",
+        "container_edit",
+        "container_exec",
+        "container_write",
+        "daemon_start",
+        "edit",
+        "pwsh",
+        "write",
+    ]);
+    assert.equal(REMOUNT_TOOL_NAME, "dsh_podman_builtin_remount_read_only");
+});
+test("all mounts read-only allows the tool without a prompt", async () => {
+    const { gate, controlCalls, approvals } = gateFixture([
+        { projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_ONLY" },
+        { kind: "MOUNT_KIND_TMPFS", destination: "/scratch", mode: "MOUNT_MODE_READ_WRITE" },
+        { kind: "MOUNT_KIND_SECRET", secret: "tls", destination: "/run/secrets/tls" },
+    ]);
+    assert.deepEqual(await gate(EXEC, "en"), { kind: "allow" });
+    assert.deepEqual(approvals, []);
+    assert.equal(controlCalls.filter(([method]) => method === "recreateContainer").length, 0);
+});
+test("a read-write mount prompts and then remounts read-only", async () => {
+    const { gate, controlCalls, approvals } = gateFixture([
+        { projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_WRITE" },
+        { kind: "MOUNT_KIND_VOLUME", volume: "data", destination: "/data", mode: "MOUNT_MODE_READ_WRITE" },
+        { kind: "MOUNT_KIND_TMPFS", destination: "/scratch", mode: "MOUNT_MODE_READ_WRITE" },
+        { kind: "MOUNT_KIND_SECRET", secret: "tls", destination: "/run/secrets/tls" },
+    ]);
+    assert.deepEqual(await gate(EXEC, "en"), { kind: "allow" });
+    assert.equal(approvals.length, 1);
+    assert.match(approvals[0], /Read-only mode blocks "bash"/);
+    assert.match(approvals[0], /- project "team" \(read-write\)/);
+    assert.match(approvals[0], /- volume "data" at "\/data" \(read-write\)/);
+    assert.match(approvals[0], /Kept as-is: tmpfs at "\/scratch"/);
+    const recreate = controlCalls.filter(([method]) => method === "recreateContainer");
+    assert.equal(recreate.length, 1);
+    assert.deepEqual(recreate[0][1], {
+        workspaceSlug: WORKSPACE_ID,
+        container: "default",
+        mounts: [
+            { projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_ONLY" },
+            { projectName: "", kind: "MOUNT_KIND_VOLUME", mode: "MOUNT_MODE_READ_ONLY", destination: "/data", volume: "data" },
+            { projectName: "", kind: "MOUNT_KIND_TMPFS", mode: "MOUNT_MODE_READ_WRITE", destination: "/scratch" },
+            { projectName: "", kind: "MOUNT_KIND_SECRET", destination: "/run/secrets/tls", secret: "tls" },
+        ],
+    });
+});
+test("a declined prompt denies without remounting", async () => {
+    const { gate, controlCalls, approvals } = gateFixture([{ projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_WRITE" }], { approve: false });
+    const decision = (await gate(EXEC, "en"));
+    assert.equal(decision.kind, "deny");
+    assert.match(decision.reason, /mounts were not remounted/);
+    assert.equal(approvals.length, 1);
+    assert.equal(controlCalls.filter(([method]) => method === "recreateContainer").length, 0);
+});
+test("an unreadable container falls through to the plain denial", async () => {
+    const { gate, approvals } = gateFixture(undefined);
+    assert.equal(await gate(EXEC, "en"), undefined);
+    assert.deepEqual(approvals, []);
+});
+test("a plugin tool targets its own container", async () => {
+    const { gate, controlCalls } = gateFixture([{ projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_ONLY" }], { containerName: "web" });
+    const exec = {
+        name: "container_bash",
+        arguments: { container: "web" },
+        agent: { session: { header: { cwd: "/proj" } } },
+    };
+    assert.deepEqual(await gate(exec, "en"), { kind: "allow" });
+    assert.equal(controlCalls[0][0], "listContainers");
+});

package/dist/secrets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/secrets.test.js

@@ -0,0 +1,181 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { MOUNT_EXEC, SECRET_TOOLS, WORKSPACE_ID, mountRequestRecorder } from "./test-support.js";
+import { READ_ONLY_TOOLS, TOOLS, toolHandlers } from "./index.js";
+test("secret tools are registered with the expected schemas", () => {
+    assert.ok(READ_ONLY_TOOLS.has("secret_list"), "secret_list must be read-only");
+    const listTool = TOOLS.find((entry) => entry.name === "secret_list");
+    assert.ok(listTool, "secret_list registered");
+    assert.notEqual(listTool.approval, true, "secret_list must not require approval");
+    assert.deepEqual(listTool.parameters.required, []);
+    const createTool = TOOLS.find((entry) => entry.name === "secret_create");
+    assert.ok(createTool, "secret_create registered");
+    assert.notEqual(createTool.approval, true, "secret_create must not require approval");
+    assert.deepEqual(createTool.parameters.required, ["name"]);
+    assert.equal(createTool.parameters.properties.length.type, "integer");
+    assert.equal(createTool.parameters.properties.length.minimum, 1);
+    assert.deepEqual(createTool.parameters.properties.charset.enum, [
+        "alphanumeric",
+        "hex",
+        "base64url",
+    ]);
+    const removeTool = TOOLS.find((entry) => entry.name === "secret_remove");
+    assert.ok(removeTool, "secret_remove registered");
+    assert.equal(removeTool.approval, true, "secret_remove must require approval");
+    assert.deepEqual(removeTool.parameters.required, ["name"]);
+    const addTool = TOOLS.find((entry) => entry.name === "container_secret_add");
+    assert.ok(addTool, "container_secret_add registered");
+    assert.equal(addTool.approval, true, "container_secret_add must require approval");
+    assert.deepEqual(addTool.parameters.required, ["container", "env", "secret"]);
+    assert.equal(addTool.parameters.properties.secret.type, "string");
+    assert.equal(addTool.parameters.properties.env.type, "string");
+    const removeEnvTool = TOOLS.find((entry) => entry.name === "container_secret_remove");
+    assert.ok(removeEnvTool, "container_secret_remove registered");
+    assert.equal(removeEnvTool.approval, true, "container_secret_remove must require approval");
+    assert.deepEqual(removeEnvTool.parameters.required, ["container", "env"]);
+    for (const name of SECRET_TOOLS) {
+        const tool = TOOLS.find((entry) => entry.name === name);
+        assert.ok(tool, `${name} registered`);
+        assert.equal(tool.parameters.type, "object", `${name} type`);
+        assert.equal(typeof tool.parameters.properties, "object");
+        assert.ok(Array.isArray(tool.parameters.required));
+    }
+});
+test("secret mount kinds forward the secret to the orchestrator", async () => {
+    const requests = [];
+    const resolver = {
+        registry: {
+            resolveByPath: async () => ({ id: WORKSPACE_ID }),
+        },
+        getConfig: () => ({ projectsRoot: "/projects" }),
+        async control(method, request) {
+            if (method === "addContainerMount" || method === "removeContainerMount") {
+                requests.push(request);
+            }
+            return {};
+        },
+    };
+    const exec = { agent: { session: { header: { cwd: "/proj" } } } };
+    await toolHandlers.container_mount_add(resolver, {
+        container: "valkey-ctr",
+        kind: "secret",
+        secret: "valkey-tls",
+        destination: "/run/secrets/tls",
+    }, exec);
+    await toolHandlers.container_mount_remove(resolver, {
+        container: "valkey-ctr",
+        kind: "secret",
+        secret: "valkey-tls",
+    }, exec);
+    assert.deepEqual(requests[0], {
+        workspaceSlug: WORKSPACE_ID,
+        container: "valkey-ctr",
+        kind: "MOUNT_KIND_SECRET",
+        secret: "valkey-tls",
+        destination: "/run/secrets/tls",
+    });
+    assert.deepEqual(requests[1], {
+        workspaceSlug: WORKSPACE_ID,
+        container: "valkey-ctr",
+        kind: "MOUNT_KIND_SECRET",
+        secret: "valkey-tls",
+    });
+});
+test("mount tools reject a read-write secret mount", async () => {
+    const { requests, resolver } = mountRequestRecorder();
+    await assert.rejects(() => toolHandlers.container_mount_add(resolver, { container: "web", kind: "secret", secret: "tls", destination: "/run/secrets/tls", mode: "read_write" }, MOUNT_EXEC), /secret mounts are read-only/);
+    await assert.rejects(() => toolHandlers.container_start(resolver, {
+        container: "web",
+        image: "img1",
+        mounts: [{ kind: "secret", secret: "tls", destination: "/run/secrets/tls", mode: "read_write" }],
+    }, MOUNT_EXEC), /secret mounts are read-only/);
+    assert.deepEqual(requests, [], "a rejected mount must not reach the orchestrator");
+});
+test("container_list returns secret_env maps on container rows", async () => {
+    const resolver = {
+        registry: {
+            resolveByPath: async () => ({ id: WORKSPACE_ID }),
+        },
+        control: async (method) => {
+            if (method === "listContainers") {
+                return {
+                    containers: [
+                        {
+                            workspaceSlug: WORKSPACE_ID,
+                            containerName: "default",
+                            status: "running",
+                            imageId: "img-1",
+                            secretEnv: { REDIS_PASSWORD: "db-pass" },
+                        },
+                        {
+                            workspaceSlug: WORKSPACE_ID,
+                            containerName: "db",
+                            status: "running",
+                            secretEnv: {
+                                A: "a",
+                                B: "b",
+                                C: "c",
+                                D: "d",
+                                E: "e",
+                                F: "f",
+                                G: "g",
+                                H: "h",
+                                I: "i",
+                                J: "j",
+                            },
+                        },
+                        {
+                            workspaceSlug: WORKSPACE_ID,
+                            containerName: "worker",
+                            status: "stopped",
+                        },
+                    ],
+                };
+            }
+            return {};
+        },
+    };
+    const exec = { agent: { session: { header: { cwd: "/proj" } } } };
+    const out = (await toolHandlers.container_list(resolver, {}, exec));
+    assert.deepEqual(out, [
+        {
+            containerName: "default",
+            status: "running",
+            imageId: "img-1",
+            mounts: [],
+            paths: [],
+            env: {},
+            secretEnv: { REDIS_PASSWORD: "db-pass" },
+        },
+        {
+            containerName: "db",
+            status: "running",
+            mounts: [],
+            paths: [],
+            env: {},
+            secretEnv: {
+                A: "a",
+                B: "b",
+                C: "c",
+                D: "d",
+                E: "e",
+                F: "f",
+                G: "g",
+                H: "h",
+                I: "i",
+                J: "j",
+            },
+        },
+        {
+            containerName: "worker",
+            status: "stopped",
+            mounts: [],
+            paths: [],
+            env: {},
+            secretEnv: {},
+        },
+    ]);
+});

package/dist/settings-commands.test.d.ts

@@ -0,0 +1 @@
+export {};